feat(r3-a): prove the offline PMTiles map on macOS - #62

Both mobile targets run the offline map and SQLite probes for real:

  iOS 26.3.1 simulator  ok, 48 source features, 3 painted, no network
  Android API 36.1      ok, 48 source features, 3 painted, no network

The same TauriFileSource works on all three platforms despite different
address shapes: macOS and iOS resolve the bundled archive to a filesystem
path, Android to asset://localhost/... — the fs plugin opens and range-reads
both without adaptation.

Vault is not exercised on mobile: it depends on the folder picker, which
needs interaction. The spec only asks for a capability check there, and that
check is still outstanding — the evidence bundle says so rather than implying
coverage.

Also stop destroying the map once the probe has measured it. Tearing it down
made it flash and vanish exactly when it succeeded, which is the opposite of
what a proof screen should do.

Generated mobile projects are not versioned: 855 MB of build scaffolding that
"tauri ios init" and "tauri android init" reproduce. The evidence bundle
carries the commands and the toolchain constraints found along the way —
rustup rather than Homebrew rust, the foreground requirement for the iOS
build, and Gradle's refusal of JDK 26.

…raint

The last outstanding combination in the target matrix. The check runs
unattended so a smoke script can perform it, and reports both what
app-scoped storage can do and whether a directory picker exists.

Result on all three platforms:

  macOS    app-scoped write PASS, directory picker supported
  iOS      app-scoped write PASS, directory picker UNSUPPORTED
  Android  app-scoped write PASS, directory picker UNSUPPORTED

"Folder picker is not implemented on mobile" — so the desktop vault model,
an arbitrary user-chosen folder such as an Obsidian directory, has no
equivalent on iOS or Android with this stack. Mobile can write Markdown, but
only inside storage that is private to the app and removed with it.

That does not sink Tauri; it forces a decision about what a mobile vault is,
which the evidence bundle now states with the three options rather than
leaving it implied. The spec asks for the constraint to be recorded instead
of faking desktop semantics.

Writing into app data also needed fs:allow-appdata-write-recursive; without
it the write is rejected as a forbidden path even with allow-write-text-file
granted.

Declared on the evidence gathered: the three required capabilities pass on
macOS, the iOS simulator and the Android emulator, across two webview
engines. Tauri is adopted; the D8 fallback of Capacitor plus Electron is not
taken.

Two points ride along with the decision rather than being closed by it:
Windows was never executed, and the mobile vault model still has to be
chosen, since no directory picker exists on either mobile platform.

directoryPicker is assigned on every path through the try/catch, so seeding
it with 'unknown' was never read. I had re-run tsc and Prettier after adding
the capability probe but not ESLint, which is why CI caught it and I did not.